/dev/console permissions

[Terrence]

My security cookbook recommends that /dev/console should not be world writeable. But even though I've changed it several times, (chmod o-w /dev/console) somehow the permission keeps getting flipped back to 622 from 620. Anyone know what would cause that file to add world writability? It's group ownership is tty so perhaps that's to blame?

[Paul Sperry]

I would set it to:

crw--w--w- 1 root sys 0 0x000000 Feb 20 16:55 console

[Paul Sperry]

as root
chgrp sys /dev/console
chmod ugo+w /dev/console